A remote stack-based buffer overflow vulnerability in Tenda AC5 routers presents a high risk of system compromise due to the availability of a public proof-of-concept.

This vulnerability resides in the decodePwd function within the WizardHandle component, which fails to properly validate the WANT/WANS argument during a POST request. An authenticated attacker can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution or system instability.

Successful exploitation of this flaw allows an attacker to execute arbitrary code on the affected router, which serves as a critical network gateway. Given the CVSS score of 8.8, this vulnerability poses a severe risk to organizational network integrity, potentially enabling unauthorized lateral movement, traffic interception, or full device takeover.

Immediate Action: Since a patch is currently unknown, users should immediately restrict access to the web management interface to trusted IP addresses only. Disable remote management features if they are not strictly required for operations.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WizardHandle endpoint. Review system logs for signs of process crashes or unexpected reboots of the Tenda device.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and drop incoming requests containing oversized payloads in the WANT or WANS parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up by the vulnerability researcher.

Given the existence of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant threat to network security. Organizations must prioritize segmenting these devices and applying vendor-supplied firmware updates immediately upon their release to mitigate the risk of exploitation.